Skip to content

Commit

Permalink
[MNG-7118] block HTTP repositories by default
Browse files Browse the repository at this point in the history
  • Loading branch information
@hboutemy
hboutemy committed Mar 19, 2021
1 parent 899465a commit 907d53a
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions apache-maven/src/conf/settings.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,9 @@ under the License.
| values (values used when the setting is not specified) are provided.
|
|-->
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 http://maven.apache.org/xsd/settings-1.2.0.xsd">
<!-- localRepository
| The path to the local repository maven will use to store artifacts.
|
Expand Down Expand Up @@ -156,6 +156,13 @@ under the License.
<url>http://my.repository.com/repo/path</url>
</mirror>
-->
<mirror>
<id>maven-default-http-blocker</id>
<mirrorOf>external:http:*</mirrorOf>
<name>Pseudo repository to mirror external repositories initially using HTTP.</name>
<url>http://0.0.0.0/</url>
<blocked>true</blocked>
</mirror>
</mirrors>

<!-- profiles
Expand Down

6 comments on commit 907d53a

@tonycody
Copy link

@tonycody tonycody commented on 907d53a Jul 14, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there an option to disable this feature?
It is currently enabled by default, which can be very frustrating for developers using HTTP repositories.
Such as:
When using the Jetbrains IDEA development tool, the development tool comes bundled with version 3.8.1 of Maven by default.
Its Maven directory is located at:

%userprofile%\AppData\Local\JetBrains\Toolbox\apps\IDEA-U\ch-3\222.3345.16\plugins\maven\lib\maven3\

The user Settings. The XML
%userprofile%\.m2\settings.xml

The maven home Settings. The XML
%maven.home%\conf\settings.xml

Since maven-default-http-blocker is enabled by default and mirror tags are merged, this means that the runtime environment maven-default-http-blocker is enabled by default.
If the user does not actively comment out the %maven.home%\conf\settings.xml maven-default-http-blocker configuration, this will cause IDEA to have persistent problems when using the bundled maven.
To annotate the configuration in this maven installation directory, this leads to a lot of trouble when using maven bundled with IDEA.
Every time you update the IDEA version, you have to comment out the bound maven global configuration.
Another way is to upgrade nexus support for https.
Can you consider adding a disabled configuration item?
Then you can disable the maven-default-http-blocker feature by mentioning an issue for IDEA?

@slawekjaranowski
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thera are is options

  • ask IntelliJ to upgrade bundled Maven
  • not use bundled Maven

@tonycody
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thera are is options

  • ask IntelliJ to upgrade bundled Maven
  • not use bundled Maven

Not only idea, but also sdk management tools like sdkman ~ unless you don't use http, because mirrors is merged.

@metux
Copy link

@metux metux commented on 907d53a Aug 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth mentioning that it can be disabled on mvn command line by adding -Denforcer.skip=true or make it not failing by -Denforcer.fail=false

@anatoliy-balakirev
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@slawekjaranowski the problem has nothing to do with Intellij Idea itself, but rather with the fact that some companies are using their own HTTP Nexuses, which are behind VPN, for example. The case from @tonycody was basically describing the situation where the Maven is coming bundled with some tool. It can be Maven Wrapper, for example, who's main idea is to avoid additional configuration on each user's machine and this feature enabled by default is kind of undermining that idea.

@tonycody
Copy link

@tonycody tonycody commented on 907d53a Mar 27, 2023 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.